AuditClaw IDP

Companion skill for auditclaw-grc. Collects compliance evidence from Google Workspace and Okta identity providers using read-only API calls.

8 checks | Read-only API access | Evidence stored in shared GRC database

Security Model

• - Read-only access: Google Workspace uses admin.directory.user.readonly scope only. Okta uses okta.users.read, okta.factors.read, okta.policies.read scopes only. No write/modify permissions.
• Credentials: Uses standard env vars for each provider. No credentials stored by this skill.
• Dependencies: Google API client + requests (all pinned in requirements.txt)
• Data flow: Check results stored as evidence in ~/.openclaw/grc/compliance.sqlite via auditclaw-grc

Prerequisites

• - Google Workspace: Service account JSON with domain-wide delegation, admin email for impersonation
• Okta: API token (SSWS) with read-only scopes
• INLINECODE5
• auditclaw-grc skill installed and initialized

Environment Variables

Google Workspace (optional; skip if not configured)

• - GOOGLE_WORKSPACE_SA_KEY: Path to service account JSON file
• INLINECODE7: Super admin email to impersonate

Okta (optional; skip if not configured)

• - OKTA_ORG_URL: Okta organization URL (e.g., https://mycompany.okta.com)
• INLINECODE9: Okta API token

Commands

• - "Run IDP evidence sweep": Run all checks for configured providers
• "Check Google Workspace MFA": Run Google MFA check
• "Check Okta password policies": Run Okta password policy check
• "Show IDP integration health": Last sync, errors, evidence count

Usage

All evidence is stored in the shared GRC database at ~/.openclaw/grc/compliance.sqlite via the auditclaw-grc skill's db_query.py script.

To run a full evidence sweep (all configured providers):
CODEBLOCK0

To run checks for a specific provider:
CODEBLOCK1

To run specific checks:
CODEBLOCK2

Check Categories (8)

Check	Provider	What It Verifies
googlemfa	Google Workspace	All active users have 2SV enrolled + enforced
googleadmins

Google Workspace | Super admin count 2-4, all with 2SV | | google_inactive | Google Workspace | No active users with lastLoginTime > 90 days | | google_passwords | Google Workspace | All users have passwordStrength == "STRONG" | | okta_mfa | Okta | All active users have at least 1 MFA factor enrolled | | okta_passwords | Okta | Password policy: minLength>=12, history>=5, maxAttempts<=5, maxAge<=90 | | okta_inactive | Okta | No active users with lastLogin > 90 days | | okta_sessions | Okta | MFA required, session lifetime <= 12h, idle <= 1h |

Evidence Storage

Each check produces evidence items stored with:

• - INLINECODE10
• INLINECODE11
• INLINECODE12: Mapped to relevant SOC2/ISO/NIST/HIPAA controls
• INLINECODE13: Human-readable finding summary
• INLINECODE14: JSON details of the check result

Setup Guide

AuditClaw supports two identity providers. Configure one or both.

Google Workspace Setup

Step 1: Enable Admin SDK API
Go to Google Cloud Console → APIs & Services → Library → Enable "Admin SDK API"

Step 2: Create Service Account
IAM & Admin → Service Accounts → Create. Enable domain-wide delegation.

Step 3: Grant OAuth Scopes
In Google Admin → Security → API controls → Domain-wide delegation, add the service account with:

• - INLINECODE15
• INLINECODE16

Step 4: Set Environment Variables

• - GOOGLEWORKSPACESAKEY=/path/to/service-account.json
• GOOGLEWORKSPACEADMINEMAIL=admin@yourdomain.com

Okta Setup

Step 1: Create API Token
Okta Admin → Security → API → Tokens → Create Token. Name: auditclaw-scanner

Step 2: Required Permissions
The token inherits the creating admin's permissions. Needs read access to: users, factors, policies.
Scopes: okta.users.read, okta.factors.read, INLINECODE19

Step 3: Set Environment Variables

• - OKTAORGURL=https://mycompany.okta.com
• OKTAAPITOKEN=your-token-here

Verify Connection

Run: INLINECODE20

The exact permissions are documented in scripts/idp-permissions.json. Show with:
python3 {baseDir}/../auditclaw-grc/scripts/db_query.py --action show-policy --provider idp